IDENTITY THEFT

1
IDENTITY THEFT

• Presented by CITS IT Security
• Susan Bedwell
• February 19, 2003

2
What is Identity?

• That which makes us recognizable and accountable
  to society and its institutions
• The common manner in which all humanity
  associates both tangible and intangible
  attributes to a unique individual

3
What is Identity Theft?

• Is where someone uses the identity of another in
  a manner that adversely affects the victims
  reputation, assumes their privileges or impacts
  the victims family

4
Statistics

• RCMP predicts 20,000 new cases will surface in
  2002
• Identity fraud is the fastest growing kind of
  fraud according to the US Federal Trade
  Commission (FTC)
• The FTC says it accounts for 40 per cent of all
  consumer fraud complaints
• In 1992 Trans Union received 35,000
  Identity-theft calls then in 2000 there were
  between 600,000 to 700,000 calls

5
Statistics

• The Council of Better Business Bureaus in Canada
  estimates that identity theft costs 2.5 billion
  a year to consumers, banks, credit card firms,
  stores and other businesses. The council states
  identity theft is growing exponentially and many
  blame the advent of electronic communications
  The Internet
• According to Canada's social insurance registry,
  there are about 1.4 million more social insurance
  cards in circulation than there are people in
  this country

6
Types of Identity Theft

• Three common types of Identity Theft
• Tombstoning
• the dead child method
• Credit/Account take-over
• is where the criminal takes the identity of a
  living person
• Counterfeit documents
• using HW/SW to create counterfeit documents

7
Tombstoning

• Research obituaries or similar archive records to
  determine sufficient information on which to
  submit an application for a birth certificate
• Sometimes the Date of Birth is missing from the
  obituary but it can be obtained from the grave
  site
• With the birth certificate the criminal can then
  apply for secondary identification

8
Tombstoning

• Advantages
• No pre-existing SIN (In the case of children)
• Doesnt co-exist with living person
• No pre-existing history to trip over
• Long term impersonation
• Once established, little or no chance of being
  detected
• Disadvantages
• Person appears out of nowhere
• Must completely abandon old identity
• No credit history
• Documents issued at the same time, need to be aged

9
Account/Credit Takeover

• Criminal steals information about living person
  through a variety of means limited only by
  imagination
• People are their own biggest source of leaked
  information
• Intent is to mirror the victim to obtain assets

10
Account/Credit Takeover

• Advantages
• ID already established
• Net 20,000-30,000 each identity
• ID is easily abandoned
• Disadvantage
• Co-exist with a living person
• Never knows how good the credit rating is
• Never sure when misuse of ID has been discovered

11
Counterfeit Breeder Document

• Using Commonly Available Hardware and Software to
  create/alter real documents
• Off-set or web printing presses

12
How do they do it?

• A social insurance number and a date of birth are
  all that's needed to assume another person's
  identity
• Mail and garbage are two ways that criminals
  harvest information, people are usually their own
  leak
• Phone solicitation
• Once personal information obtained they apply for
  a Birth Certificate, new Identification and
  transfer Credit Cards to new address

13
How Is Identity Theft Discovered?

• An arrest is made on the street
• An individual discovers someone has been using
  their identity
• Inter-agency cross referencing of fraudulent
  names and addresses
• Complaints received from banks and financial
  institutions

14
How to Protect Yourself

• Locked Mailbox
• Shredding name/address documents
• Check your Equifax report annually
• Dont provide SIN unless required by law
• Dont have cancelled cheques sent to residence

15
How to Protect Yourself

• When asked for personal information, ask how it
  will be used, why it is needed, who will be
  sharing it and how it will be safeguarded
• Never carry more ID than you need leave your
  passport, SIN card, birth certificate, extra
  credit cards, your driver's licence (if you don't
  need it) in a secure place at home
• Take advantage of technologies that enhance your
  security and privacy when you use the Internet,
  such as digital signatures, data encryption, and
  "anonymizing" services

16
How to Protect Yourself

• Don't give your credit card number on the
  telephone, by electronic mail, or to a voice
  mailbox
• Pay attention to the billing cycle for everything
  - if it's late call the company
• See article http//www.cbc.ca/consumers/indepth/
  identity/
• Ask that your accounts require passwords before
  any inquiries or changes can be made, whenever
  possible

17
How to Protect Yourself

• Choose difficult passwords NOT your mother's
  maiden name. Memorize them, change them often.
  Don't write them down and leave them in your
  wallet, or some equally obvious place
• Key in personal identification numbers privately
  when you use direct purchase terminals, bank
  machines, or telephones
• Find out if your cardholder agreement offers
  protection from credit card fraud you may be
  able to avoid taking on the identity thief's
  debts

18
Who is responsible to protect our identity?

• Each individual is responsible to protect their
  own identity
• There is no single agency responsible to protect
  an individuals identity

19
Current Laws in Canada

• Sections 403 (Personation), 380(1) (fraud), 367
  (forgery) 362(1)(b) (false application for
  credit) sec 362((1)(a)uttering a forged doc)
• No Criminal Code offence for simple possession
  of false identification

20
Solutions Federal Govt

• A national identification card with biometrics
• Laws / legislation
• Co-operation amongst policing agencies
• Greater leadership from Federal Government
• Educate the public
• Co-ordinate and investigate identity theft
  nationally

21
Solutions - Provinces

• Consistent and compatible protocols for issuing
  documents, sharing information etc.
• Information systems that are compatible with one
  another
• Increased dialogue with one another

22
Websites and Resources

• Equifax Personal Credit Check
• http//www.equifax.ca/
• Better Business Bureau
• http//www.bbbvanisland.org/
• RCMP What is Identify Theft?
• http//www.rcmp-grc.gc.ca/scams/identity.htm
• Privacy Commissioner of Canada
• http//www.privcom.gc.ca/fs-fi/02_05_d_10_e.asp
• CBC News Mail Theft
• http//cbc.ca/cgi-bin/templates/view.cgi?category
  Canadastory/news/2002/03/16/mail_theft020316

23

24

• Questions?